Trident Defense Tech

Your RMF package, assessed objective by objective.

RMF Sprint builds the Security Control Traceability Matrix, System Security Plan, SAR / RAR, POA&M and ConMon plan for a DoD or DCSA system from its CNSSI 1253 baseline, your documents and your STIG and scan results. The files come out as Excel and Word, ready for your review and for eMASS.

Scan files and checklists are read in your browser and never uploaded.

See pricing Watch the 18-second demo
Four rows of a generated SCTM (synthetic system). Each SP 800-53A objective gets its own row, status and test result.
ObjectiveStatusTest result
AU-01a.[01]Compliant Examined SOP-AU-01 Audit and Accountability SOP, v2.1, 2026-10-15 against AU-01a.[01]; the objective is satisfied. Attested by Pat Smith, ISSO.
SI-02a.[01]Non-Compliant Tested: STIG checklist results on SYNTH-WS01, 3 of 4 applicable rules passed. Finding: failed V-990010. See POA&M item 1.
PE-02a.[01]Compliant, inherited Inherited from DISA, authorization eMASS ID 1234. System-specific: none (fully inherited).
AC-02a.[01]Not Reviewed Draft, not yet assessed: no evidence yet, so nothing is claimed.

One tool for each step of the RMF

Organized by the NIST SP 800-37 steps. Nothing is marked Compliant, Implemented or Inherited without evidence, a document you list, or a provider you name.

  1. Categorize

    • FIPS 199 confidentiality, integrity and availability from NIST SP 800-60 Vol. II information types, with the high-water mark and a written justification to lower a level.
    • Privacy risk worksheet from the CNSSI 1253 Privacy Overlays (seven risk factors, a suggested level, the SAOP’s approval) in the SSP and the Body of Evidence.

  2. Select

    • CNSSI 1253 baselines as the DoD RMF Knowledge Service selects them, or the JSIG baseline for SAP systems.
    • CNSSI 1253 overlays: Classified Information, Privacy, Space Platform, Cross Domain Solution, Intelligence and Industrial Control Systems, plus the DoW overlays and overlays your team imports.
    • An ODP worksheet for every organization-defined parameter, with the value’s source.

  3. Implement

    • SSP control narratives (who, what, how, where, how often, where documented) and a Word SSP.
    • A document register: list your SSP, plans, policies and SOPs with title, version and date. A fully cited document attests the controls it covers.
    • Inherited controls: name the common control provider and its authorization; the controls become Inherited or Manually Inherited, Common or Hybrid.

  4. Assess

    • An SCTM with one row per SP 800-53A Rev 5 assessment objective and its DISA CCI, or one row per control.
    • Test results from STIG checklists (.ckl, .cklb), SCAP / SCC results and Nessus or Rapid7 scans, read in your browser. A failing result makes its row Non-Compliant and opens a POA&M item that names the SCTM rows.
    • SAR / RAR sheet and a “Placeholders to Fill” sheet that lists anything still missing.

  5. Authorize

    • POA&M in the eMASS import layout, POA&M Triage from scans, and a POA&M Tracker with milestones and risk acceptance.
    • eMASS Reconciler: fills your eMASS Test Result import workbook, writing only Compliant, Non-Compliant or Not Applicable with a complete statement.
    • eMASS Package Linter and OSCAL 1.1.2 export (SSP, assessment results, POA&M).

  6. Monitor

    • ConMon Planner: cadences from your ODP values and CNSSI 1253, a three-year plan workbook and a Word ConMon Plan.
    • ConMon checks performed step by step, signed by the performer and reviewed by the ISSM, with a due and overdue dashboard.
    • Evidence recorded by its SHA-256 (the file stays with you) and a signed evidence-log export.
    • FIPS 140 cryptographic module checks for SC-13, and compliance metrics.

RMF Sprint is an engineering tool for ISSOs, ISSMs and assessors. It is not a substitute for a Security Control Assessor or an Authorizing Official, and it does not guarantee an ATO.

See a package built

What the video shows

18 seconds, no sound. A synthetic system and synthetic scan files; no real data.

  1. In the Package Builder, the system is named Synthetic-Enclave-01 and its confidentiality is set to High and availability to Low.
  2. The HIPAA / DHA ePHI control set is ticked and the SCTM is set to one row per SP 800-53A objective.
  3. Six synthetic files are attached: SCC results, STIG Viewer checklists and Nessus reports for two workstations.
  4. Generate Master BOE builds the Excel workbook and it downloads; then the Word SSP is generated and downloads.
  5. The workbook’s SCTM sheet opens: one row per assessment objective with its CCI, implementation status and compliance status.
  6. Its POA&M sheet opens: one item per failed check, with the finding and the affected controls.
  7. The Word System Security Plan opens at its title page.

Pricing

Every plan includes every feature and unlimited systems and packages. Plans differ by users.

RMF Sprint plans, billed annually unless noted
SingleTeamEnterpriseMore than 25 users
Users1 user10 users25 usersMore than 25 users
SystemsUnlimited systems and packagesUnlimited systems and packagesUnlimited systems and packagesUnlimited systems and packages
Price$1,995 / yearor $199 / month by card$5,995 / yearannual$14,995 / yearannualQuote
DeploymentHostedHostedHostedHosted. Self-hosted / air-gapped edition: planned, not available today
Buy SingleRequest a PO / Net-30 invoiceBuy TeamRequest a PO / Net-30 invoiceBuy EnterpriseRequest a PO / Net-30 invoiceRequest a quote

Prices in USD; subject to change. Buy opens the RMF Sprint Billing page at rmfsprint.com: sign in or create your account, then pay by card on Stripe’s checkout page (we never see your card details). To pay by purchase order, use “Request a PO / Net-30 invoice” or email support@tridentdefensetech.com: we send a Net-30 invoice payable by ACH, wire or card.

Questions

Where is my data?

RMF Sprint is hosted in a commercial cloud (AWS) for unclassified, non-CUI information only. STIG checklists, SCAP results, Nessus and ACAS scans and eMASS export workbooks are read by software that runs in your browser; their content is not sent to or stored by the service. ConMon evidence files stay on your device too: only their name and SHA-256 hash are recorded.

The service stores what you type into its forms (systems, POA&M items, ConMon results, Package Builder selections) and the documents it generates from them. See section 2 of the Terms.

Can I use it for CUI or classified information?

No. The hosted service is not authorized for Controlled Unclassified Information or classified information and holds no DoD Impact Level authorization or provisional authorization. Do not type CUI into its forms. A self-hosted edition is planned but not available today.

Is RMF Sprint affiliated with the DoD, DISA or DCSA?

No. RMF Sprint is not affiliated with or endorsed by the DoD, DISA or DCSA. eMASS is a DISA system: RMF Sprint prepares the workbooks and text you import or enter there yourself, and it does not connect to eMASS.

Which baselines and overlays does it support?

NIST SP 800-53 Rev 5 controls with SP 800-53A Rev 5 assessment objectives; CNSSI No. 1253 baselines for Low, Moderate and High as the DoD RMF Knowledge Service selects them; the JSIG baseline for SAP systems; and the CNSSI 1253 overlays (Classified Information, Privacy, Space Platform, Cross Domain Solution, Intelligence, Industrial Control Systems), the DoW overlays and overlays you import. A HIPAA / DHA ePHI control set and Zero Trust alignment are RMF Sprint-defined, not official overlays.

Does RMF Sprint get my system an ATO?

No tool can. RMF Sprint does the repetitive work of building and checking the package; your assessor and Authorizing Official make the decisions.

How do Team and Enterprise licenses work?

The person who buys is the license owner. From their Profile they invite up to 10 (Team) or 25 (Enterprise) users by email, including themselves; each invitee opens the invitation and signs in with that email. A released seat can be reassigned after 24 hours. Every plan has unlimited systems and packages.

Can we pay by purchase order?

Yes. Request a PO / Net-30 invoice with your organization, PO number and billing contact. Your license works from the day the invoice is sent; an invoice still unpaid 14 days after its due date pauses access until it is paid. A W-9 is available on request.

What happens if a card payment fails?

Access pauses at once for everyone on the license until the payment goes through. The owner updates the card from the Billing page and access returns as soon as it is paid. Cancelling keeps access until the end of the paid period.

Is there an on-premises or air-gapped version?

Not yet. A self-hosted edition is planned for a future release and is not available today. Email support@tridentdefensetech.com to hear when it is.